Is a Phone Number PHI? HIPAA Rules for Call Data

It depends on who holds the phone number and what it is linked to: a phone number is PHI when a HIPAA covered entity or its business associate holds it with information about a person's health, care or payment, because "Telephone numbers" are item (D) on HIPAA's identifier list in 45 CFR 164.514(b)(2)(i). HHS says a number becomes PHI when "listed with health condition, health care provision or payment data" (HHS). Curve Compliance, which signs a BAA on every plan, credits calls from ads to the original ad click while each ad platform receives only a fixed list of fields.

Book a call. Curve's team will review what your website sends to Meta, Google and TikTok with you, then credit calls and form leads to the original ad click, with PHI removed before anything is sent to an ad platform. Book a call with Curve.

The answer and the rule

HIPAA's definition in 45 CFR 160.103 has two halves. The information must relate to a person's health, care or payment for care, and it must identify the person, "including demographic information collected from an individual." A phone number is the identifying half. The health half can be a booking request, a symptom typed into a form, or simply the fact that someone is a patient: HHS's example is "an indication that the individual was treated at a certain clinic" (HHS).

Partial numbers count too. Asked whether "parts or derivatives of any of the listed identifiers" may stay in data de-identified under Safe Harbor, HHS answers "No"; its example is "the last four digits of a Social Security number," and the same goes for the last four digits of a phone number (HHS). See the 18 HIPAA identifiers, examples of PHI for 30 other data types, and the spokes on email addresses, dates of birth and ZIP codes.

When a phone number is not PHI

• In a public listing. HHS gives "a phone book" as its example of identifying information that is not PHI (HHS).
• Held outside HIPAA. The rules apply to health plans, health care clearinghouses, health care providers that conduct standard electronic transactions, and business associates (45 CFR 160.102). A number held by any other business is not PHI.
• In staff records. PHI excludes "employment records held by a covered entity in its role as employer" (45 CFR 160.103).
• The clinic's own numbers. A main line or a tracking number on an ad belongs to the business. The Safe Harbor list covers identifiers "of the individual" (45 CFR 164.514).

Call tracking: tracking numbers, caller IDs and recordings

Call tracking puts phone numbers in two places. The tracking number on an ad or page is the clinic's. The caller's number is the identifier: Google Ads call reporting tracks "call duration, call start time, caller phone number," the number for calls over 15 seconds outside India (Google Ads Help). Who needs a BAA follows from what the vendor keeps. HHS says a carrier that "is only connecting the call" is a conduit, but "a covered entity must enter into a BAA with a vendor that is more than a mere conduit for PHI," such as an app that stores recordings or transcripts (HHS). See which call trackers sign a BAA and call tracking architecture. Which rules apply to your calls depends on your facts, so talk to your counsel.

Where phone numbers show up on a website and in ad data

Where it shows up	What it looks like	Is it PHI?
Booking or contact form	A number typed with an appointment request	Yes, once a covered clinic holds it. HHS treats details typed while booking an appointment as PHI (HHS).
Page or thank-you URL	?phone=15555550100 in the query string	Yes when it comes from a booking flow, and every tag on the page sees it: the browser sends "the URL of the page you're visiting" (Google).
Call log	Caller ID, call start time and duration	Yes for calls to a covered clinic about care. Google Ads call reporting records the "caller phone number" (Google Ads Help).
CRM, EHR or billing record	The number on a patient profile	Yes, when listed with care or payment data (HHS).
Ad platform match key	Meta's "ph" parameter, marked "Hashing required."	Meta calls phone numbers "Contact Information" that it uses "for matching purposes only" (Meta). Hashing does not take a number out of HIPAA; see is a hashed email PHI, which covers phone numbers too.
Click-to-call link	The clinic's number in a button	No. The click is an event, and the number is the clinic's.

HHS's tracking rule covers all of these: regulated entities "are not permitted to use tracking technologies in a manner that would result in impermissible disclosures" of PHI to tracking vendors (HHS). As HHS notes on that page, a court vacated one part of the guidance on June 20, 2024, about IP addresses and visits to unauthenticated public pages; see what counts as PHI on a website.

How Curve Compliance helps

Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, and each platform receives only a fixed list of fields. Contact identifiers, phone numbers included, are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Calls arrive from a call tracker such as CallRail through incoming webhooks, and Curve credits each one to the original ad click. Event Logs show what Curve sent to each platform and what each platform accepted.

Curve collects this data under the BAA it signs on every plan, and Curve is SOC 2 Type II. Your call tracker and phone system each need their own BAA. Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: 45 CFR 164.514; 45 CFR 160.103; 45 CFR 160.102; 2 CFR 200.1; HHS, de-identification guidance; HHS, online tracking bulletin; HHS, audio-only telehealth guidance; HHS, 42 CFR Part 2 fact sheet; HHS, Security Rule NPRM; HHS, regulatory initiatives; Google Ads Help, call reporting; Google, partner sites; Meta, customer information parameters.

Frequently Asked Questions

Is a phone number considered PHI?

It is when a HIPAA covered entity or business associate holds it with information about a person's health, care or payment, because "Telephone numbers" are on HIPAA's identifier list (45 CFR 164.514). With no health information attached, as in a phone book, it is not (HHS).

Does PHI include telephone number?

Yes. "Telephone numbers" and "Fax numbers" are items (D) and (E) of the Safe Harbor list (45 CFR 164.514), and HHS says "personal names, residential addresses, or phone numbers" become PHI when listed with health, care or payment data (HHS).

Is someone's phone number considered PII?

Usually. HIPAA does not use the term. The federal grant rules at 2 CFR 200.1 define it as "information that can be used to distinguish or trace an individual's identity" and note that "Some PII is available in public sources such as telephone books, websites, and university listings." See PHI vs PII.

Are account numbers part of PHI?

Yes, when tied to a patient. "Account numbers" are item (J) on the list (45 CFR 164.514), and a clinic billing account relates to "payment for the provision of health care" (45 CFR 160.103).

What information is not included in PHI?

De-identified information, which "is not individually identifiable health information" (45 CFR 164.514(a)), and the exclusions in 45 CFR 160.103: FERPA education and student treatment records, "employment records held by a covered entity in its role as employer," and records of a person "deceased for more than 50 years."

Are phone calls HIPAA compliant?

They can be. HHS expects "reasonable safeguards," such as "using lowered voices and not using speakerphone." It says the Security Rule "does not apply to audio-only telehealth services provided by a covered entity that is using a standard telephone line," but it does apply to VoIP and smartphone apps (HHS).

Can I make my phone HIPAA compliant?

HIPAA sets duties for organizations, not devices (45 CFR 160.102). HHS says a risk analysis should check whether a phone or app "supports encrypted transmissions," requires authentication and "locks after a period of inactivity" (HHS). See HIPAA compliant phone systems.

What is the new HIPAA rule in 2026?

There is no single new rule. Compliance with updated notice of privacy practices requirements and with the 42 CFR Part 2 rule was required by February 16, 2026 (HHS; HHS). The Security Rule update HHS issued on December 27, 2024 is still a proposed rule (HHS); see the new HIPAA rule in 2026.

Talk to Curve Compliance

Book a call. Curve Compliance sends your ad conversions server-side, credits calls from your call tracker to the original ad click and strips PHI before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.